Here again your favorite Random Dude.

Today topic is something that I find pretty interesting and it is Secure Boot and the SDA. As you know KACE can't do PXE Secure Boot due to issues that they have with getting their cert (source), but I figured that if you create a USB KBE (guide on how to do that HERE) you can get the Secure Boot to work with the USB.

I did my deployment as usual, but after doing so I discovered that Bitlocker was enabled on its own. I didn't have a task or anything to enable that. I got a ticket with KACE, and one of their engineers told me that he saw this situation before and provide me the following:

https://docs.microsoft.com/en-us/mem/configmgr/osd/understand/task-sequence-steps#BKMK_PreProvisionBitLocker

So from what I understand, if you are on UEFI with TPM on and Secure boot on, Bitlocker is going to kick in on its own.

The engineer also mentioned that one of his customers solved by modifying a registry key on a mid-level task.

Here is how his customer solved it.

--------------------------------------------------------------

[DISK] Apply BIOS/UEFI Partitions (Built in K2000 mid level task)

Run disable Automatic Bitlocker

--------------------------------------------------------------

The "Run disable Automatic Bitlocker" contains the following commands:

REG LOAD HKLM\OFFLINE C:\Windows\System32\Config\System

REG ADD HKLM\OFFLINE\ControlSet001\Control\BitLocker\ /v

PreventDeviceEncryption /t REG_DWORD /d 1

REG UNLOAD HKLM\OFFLINE

And that's it, with this it won't do the encryption on its own and is up to you to encrypt it later with your preferred settings.

I hope this helps someone. If you have any questions or comments put them down there.

See you in my next post!